Securify

A critical use-after-free vulnerability in the Linux kernel’s TCP stack — present in every kernel release since version 4.4 — is forcing administrators worldwide into emergency patching. Tracked as CVE-2026-98432 and carrying a CVSS score of 9.8, the flaw allows an unauthenticated remote attacker to crash servers, leak kernel memory, and potentially gain root access. With patches still incomplete across major enterprise distributions, this is the kind of bug that keeps sysadmins up at night.

What Happened

On October 15, 2026, the kernel.org CNA published CVE-2026-98432, disclosing a race condition in the Linux kernel’s IPv4 TCP handshake code. The fix — a deceptively simple two-line patch — had been quietly merged into upstream stable branches on October 5, following a coordinated disclosure process that gave vendors a 90-day window plus an additional 45-day extension.

The vulnerability was reported by Xinyang Ge of Anthropic’s Frontier Red Team. On October 27, Anthropic published a write-up revealing that one of its unreleased research models had independently written a working exploit — one that leaked a kernel pointer in roughly 48 minutes and achieved a root shell approximately five minutes later on a server running an MPTCP listener. While the exploit code has not been made public and no independent reproduction has been confirmed, the disclosure added urgency to an already critical situation.

The Technical Details

The bug lives in how the kernel handles IPv4 options during the TCP three-way handshake. When a SYN packet arrives carrying IP options — such as Record Route or Timestamp — the kernel stores those options alongside the pending connection request. When the handshake completes and a new child socket is created, the pointer to those options is passed along without being copied. Both the request socket and the child socket now reference the same block of memory.

Here is where the race condition enters. Since kernel 4.4 (January 2016), request sockets are processed without holding the listener lock. This means one CPU can be tearing down a request socket and freeing its options memory via kfree(), while another CPU — handling a retransmitted SYN — reads that same memory under only an RCU read lock. The result is a classic use-after-free: the second CPU reads memory that has already been freed and potentially reallocated.

The consequences range from leaking adjacent kernel heap bytes to the remote peer, to out-of-bounds writes via a stale length field, to a kernel panic from accessing a reclaimed memory region. Crucially, losing the race only causes a single handshake to fail — the server stays up, the port stays open, and the attacker can retry indefinitely until they win.

A secondary attack path exists through request socket migration, which requires the net.ipv4.tcp_migrate_req sysctl to be set to 1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program to be attached. Both are off by default. An IPv6 variant through CALIPSO option handling has been identified and is receiving a separate patch.

Who Is Affected

The short answer: nearly every Linux server deployed in the past decade. The vulnerable code was introduced by commit 079096f103fa, which shipped in Linux 4.4 in January 2016. Any kernel from 4.4 onward that has not received the fix is vulnerable. RHEL 7 and CentOS 7 are the notable exceptions — they are not affected.

The upstream fix has landed in stable branches 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10, and 7.3-rc7. However, the distribution picture is uneven. As of the end of October, Debian had shipped fixes for both Bookworm and Trixie. SUSE published nine advisories between October 29 and 30, covering most of its supported lineup. Amazon Linux 2023 is patched. Oracle shipped fixes for its Unbreakable Enterprise Kernel on October 16.

Red Hat, however, has not yet released a fix for RHEL 8, 9, or 10. Its bulletin RHSB-2026-016 rates the impact as Critical and says fixes are being “expedited,” but provides no timeline. This leaves the RHEL ecosystem — including AlmaLinux, Rocky Linux, and CloudLinux — exposed. Ubuntu is similarly still working on patches for 26.10, 26.04, 24.04, and 22.04, with older releases (20.04, 18.04, 16.04) receiving no fix at all.

The AI Exploit Angle

What sets this disclosure apart from a routine kernel CVE is the AI dimension. Anthropic’s claim that a research model wrote a functioning exploit for a novel kernel vulnerability represents a milestone in the intersection of AI and offensive security. According to Anthropic’s write-up, the exploit chain works in two stages: first, the model wins the race to leak a kernel pointer, defeating KASLR; then it uses the bug to overflow a buffer and overwrite a callback pointer, redirecting kernel execution to run an attacker-chosen command.

The exploit targets servers with MPTCP listeners specifically. Go 1.24 and later enable MPTCP listeners by default on Linux, which means any Go service built with a recent toolchain could be exposing the necessary attack surface without the developer explicitly choosing to do so. The Go security team issued guidance on October 29 recommending that developers set GODEBUG=multipathtcp=0 as a temporary measure.

What You Should Do Now

Patch immediately if your distribution has shipped a fix. Debian, SUSE, Amazon Linux 2023, and Oracle UEK users should update and reboot without delay. Remember that installing a kernel package does not change the running kernel — a reboot is required. Live patching is available through Ubuntu Pro and SUSE for organizations that cannot schedule immediate downtime.

If you are on RHEL, Ubuntu, or a derivative still waiting for a patch, Red Hat’s bulletin suggests an nftables rule to drop inbound TCP packets with IP options longer than 20 bytes: ip protocol tcp ip hdrlength > 5 drop. Test this carefully in your environment, as it may break rare clients that send IP options.

Check your MPTCP exposure. Run ss -H -lMn to list any MPTCP listeners on your systems. Confirm that net.ipv4.tcp_migrate_req is set to 0. If MPTCP is not needed, disable it with sysctl -w net.mptcp.enabled=0 and persist the setting in /etc/sysctl.d/.

Audit your Go services. If you’re running Go applications built with version 1.24 or later, set GODEBUG=multipathtcp=0 in the service environment or add godebug multipathtcp=0 to go.mod. Be aware that code explicitly calling SetMultipathTCP overrides this setting.

What to Watch

No in-the-wild exploitation has been reported as of November 1, and CVE-2026-98432 is not yet in CISA’s Known Exploited Vulnerabilities catalog. But the ingredients for widespread exploitation are all present: the vulnerability is remotely triggerable, requires no authentication, affects a decade’s worth of kernels, and the retry-friendly nature of the race condition makes it patient-attacker-proof. The gap between upstream fixes and enterprise distribution releases is where the real risk lives right now. Every day without a patched kernel running is a day of exposure — treat this one as urgent.